d793fe45400bcea8b3f7e0acb6a64eaf3a7ef3f45042bc787aee4469d63bb0b1

Analysis

max time kernel
46s
max time network
156s
platform
android_x64
resource
android-x64-20240624-en
resource tags

androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
submitted
24-08-2024 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Application.apk
Size

2.8MB
MD5

369c156b46407d1c995957540d919557
SHA1

7bebd8b3b5104d1fe2ed39ef60574b58c38f4eee
SHA256

d793fe45400bcea8b3f7e0acb6a64eaf3a7ef3f45042bc787aee4469d63bb0b1
SHA512

94ca26375baaf0fa75f9feec26c188ad410a3a1ac4d33421fff227d8f85be7a898c65346009e90ebfa3b3c96d1026ac7328555df3c1b8c075a5e611cb5c2f47f
SSDEEP

49152:CTbdsl35rnglmqdJy2WTx8Xt8VaamfvXV+1tda1Mt54OLkf2fbFfNTeMvP1fX:CHy0mqTy2UU8ViQv+Mt54CjRFTeMvtfX

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
collection credential_access impact

Clipboard Data
T1414

Transmitted Data Manipulation
T1641.001

Processes:

X.God.X

description ioc process

Framework service call android.content.IClipboard.addPrimaryClipChangedListener X.God.X
Acquires the wake lock 1 IoCs

Processes:

X.God.X

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock X.God.X
Queries information about active data network 1 TTPs 1 IoCs
discovery

System Network Connections Discovery
T1421

Processes:

X.God.X

description ioc process

Framework service call android.net.IConnectivityManager.getActiveNetworkInfo X.God.X
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
discovery

System Network Configuration Discovery
T1422

Processes:

X.God.X

description ioc process

Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone X.God.X
Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
persistence

Broadcast Receivers
T1624.001

Processes:

X.God.X

description ioc process

Framework service call android.app.IActivityManager.registerReceiver X.God.X
Checks memory information 2 TTPs 1 IoCs

System Checks
T1633.001

System Information Discovery
T1426

Processes:

X.God.X

description ioc process

File opened for read /proc/meminfo X.God.X

description	ioc	process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	X.God.X

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	X.God.X

description	ioc	process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	X.God.X

description	ioc	process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	X.God.X

description	ioc	process
Framework service call	android.app.IActivityManager.registerReceiver	X.God.X

description	ioc	process
File opened for read	/proc/meminfo	X.God.X

X.God.X
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks memory information
PID:5069

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Event Triggered Execution

T1624

Broadcast Receivers

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Discovery

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
afbbac91c0cc003ef6aa4b545f50f1d9

SHA1
91b11720e87081f8812fefd0e7d4956aae775f5d

SHA256
dcd12235b8619502ab1f067cf9446b7d5f6cc47291416411ba905670b60996e8

SHA512
f1d78d4820192f2ebc00d1f5d95811b1749a4aa0a58f53d682243f3aeb6730584e7fab38796f8b79d3e446f2181dac0daa6c91cf6ea7251d139a36f577e2e2f4

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
024b6d3de587e637173cdf2d0b0bce9a

SHA1
7d2fbfdea9f2d869577fa7cfbc70a6306f4fd433

SHA256
105509b898356d62043c6bc673dc5d1da2a40c41482abc72c58343f31db79b91

SHA512
337c2bb4ea7af138f2dd76393579344bc050d04b37478acc9b00e6f995e3f6f2bd676716b9927d45b9d20629cf6fc2fa83e1580475da4d4ffe6f9cec4c6bf5e7

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
a46f1ae6c20dc13b655e5d186800aadd

SHA1
2bd44bb00d83fb7b0e816088d00d053ba1a03837

SHA256
e00cf6618d9ab61d15b3951180a42ef3aee5ec691d90359888ba94e8aa333694

SHA512
59311e654184d9465cbcbe3ae0d98521c7d1423c7dc2ecb43c5509a33dd7369b676f24fd59c9d497bdf3e749a80acc15a7ce8a5fdd31aabccd1ed07e0061bda9

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
fd54380e2abb9e23c8e4b88a4fbb1e26

SHA1
d529d2bf5351bad4c8ee2d7003f57a41308ec798

SHA256
bea622316be728f42485c7fd92d75cdb1a90d3e42c61c230f1070086abbe75e5

SHA512
49727ab3439b83e98a93fb99a0093cc67b2fe6fd804592d9b58c3853be60ac089eb94c9d8a9a4fb13829ecaecb9d901b30bbe188ff4abcf3f3fb744b9a1d4044

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
adf6082723784327d7d1b34adf974e7d

SHA1
b1502f70eb881a1dfe41139cb719fefb877ee37c

SHA256
252defb835b04f4af7c59bde7bd119664e901928f1373171a287897e729cb2a9

SHA512
762f146c452e590e0e3015a080e9821b5488551b9cca7a212ceb11a853ddf6b1894c99d09ba20e6691f5078aaa8e17a6ed66dbbe541eaee152978fab6884e27b

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db

Filesize
16KB

MD5
eb52a90bb70b76e946b62f50b6f7fb85

SHA1
42d767b5d1faa7dcef4cb4e1432a5f47ec2e9ee0

SHA256
48472f593a3e9cf9e91ee5f7d66dd9ff291bfb247eb6b46778c710fc24e8d3c4

SHA512
b356c858cadd14b6ecddf134f1c494c0107a1d36be9387984fc53dcb00e6779d944f058f4ac99d0fc2fe3a427cd1c2921c6fc38ecad53909fc4b5b6f04459b5c

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
fdbd11c5bf96b5ca61dbb1b245121ab3

SHA1
ba3990ad0c4f24c25ebff6e875bcb12ef161037c

SHA256
d1d79ec7fb699ce5689c3141d48755d63d7ef2025467df49cb6cef304a1cdbca

SHA512
3d96d1683bdd1774f9ec0aedc87bd09628a6de0c1091bf7317677c6e154c189e1b3a8eb22c23e57ebe0c5a4500e8cb4892a3563e6a5e328bf68a44bf0428f277

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
1c7faf3a68053407a7f6ebb031dc7f57

SHA1
a87371d036745920a884553b59aa0a8a98a83972

SHA256
ed34037bd3e1c5947aa8a8037f682f4ee54d2fb5476cd6837bdef533e7c9fd2d

SHA512
4a5684325a713f249bfb1984896456c217dc4ad095d6028130f6fc48c6daa1a8263b747dc1f61aecb0f8a87e8ccfc8fbb0e240d131902f1e3808dbd6540af65b

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
512B

MD5
884fd13fe334e00ed647d2f29c6444f3

SHA1
e9a641ec15339a30f40a0d160b77bb4de1600dd6

SHA256
35e9241ce5ed09392e4d3b640555dc53f72dabff56a2827276c77ffa673dba71

SHA512
2a3afbeaf88e35e59ee6b715507f8f0e34d137c6423c1f0403378cf4ded2c2a4eb5c0034e5758dc102adbc9720d6e279c1c91e15a22fdb19f81cafd20793185d

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
1732f7faa1a7a0c5758c3d800dc9ef68

SHA1
bf80fc58e9743016fd7a8fe3e6c658a796c2b1c1

SHA256
ad77c4e6095e54910ec4d9ca0032180e8132c697e54ec65ba5d6cc33763b3079

SHA512
7d173564db3f0ff544951039659450ac9119d861967b39cf671cb60ebcae65c718322b1ed0837c3c923659a66e0cd1bcd6091bf4c4ec04c1eabc0263b3596d1f

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
4KB

MD5
6c63ee132f4a102a2d09c66001356a84

SHA1
2dd79172793fbb8a4292ceda6a91c2970e17b6de

SHA256
802f94784e112f7d99647668a8a3524119cc6606b17589f0e4faccd590edb024

SHA512
e271a03fd50931efb1f026e53163177b47bb976021ddceccf5627ee44a0bc9958d0ee764944f7129e7cb7ebb8323daea6d112f19703453488fdb5e906e9b99b9

Download Submit
/data/data/X.God.X/databases/google_app_measurement_local.db-journal

Filesize
8KB

MD5
9112fc6fc5fd2d21bd9cb98a1a33f358

SHA1
e1614271e7561c96d352fa6fe88080126d416613

SHA256
d1f7c80154b23955fc22ba6e5eefd7beaa92c0fbd34363f54605bd9c3a1b762e

SHA512
415c4185bb01967c6b8e0bf1cbfde14a58718b155162b9335012da1065d393ff29adb5fceec464d4146177bb4d34a7e25413b148adf4168089d0df3350b66f46

Download Submit
/data/data/X.God.X/files/PersistedInstallation2799658580716742850tmp

Filesize
566B

MD5
d1102532192c50e6afa5789af36f8507

SHA1
9d97bac4bd4c4e1c092ccef4bfea926a1c1c5002

SHA256
6790201028daa65b0f575013c07d2d97a854007aecbcedae9e0f4b6293747fe7

SHA512
c7768ea3f36cb1f9ef321d5d96e68058ff24dbb37d5e3be6002ca0fbad07e18e68a7e4c302a21959ef0f34dd36b13cde878ef1488ad51a6fda55aaaea1fd2d03

Download Submit
/data/data/X.God.X/files/PersistedInstallation5300788596477527482tmp

Filesize
90B

MD5
58e0b0233ea9ca2092885fc3d8d9bd15

SHA1
a9431c94c24ea7011a1f83c35e7d6b508c518487

SHA256
8c9ee695499a20b2345beef734cec11b6c289fb576b0afddafca4b6b7505649b

SHA512
18acb03edbf236e4fa393a494b66d49f4699280599509681505b935b30ebc56eb79527d20a4d88327f34c8ead14b74e7fa38f614d372b63935300cd54bc92b4e

Download Submit